Internet Explorer 8 Trounces Firefox, Chrome in Security Test
Microsoft gets a lot of grief (and deservedly so) for the insecurity of its products. But when it comes to stopping common Web-based attacks against browser users, its Internet Explorer 8 topped the field of major browsers in a security test conducted by NSS Labs. Within each Web browser are discreet features that guard against malicious activity, such as phishing attacks, pixel-embedded malware, digital certificate inspection, Website reputational analysis and cross-site scripting (XSS) attacks. In the NSS Labs test with live traffic, Internet Explorer 8 caught 81 percent of the attacks coming over the wire. IE8 vastly outperformed the second closest rival, Firefox 3, which caught 54 percent of the inbound threats. IE8’s performance improved 12 percent over a similar test conducted the previous quarter; NSS Labs credits continual improvements to its SmartScreen technology. The virgin install of Firefox 3 failed to impress testers, but it did dramatically improve when with Google’s SafeBrowsing, a plug-in that inspects Websites for malicious or fraudulent characteristics. Google’s ballyhooed browser Chrome (v2) only caught 7 percent of the threats, a drop of 8 percent from the previous test. Safari 4 picked up 21 percent of the threats and Opera 10 beta was the worst performer, detecting just 1 percent of malicious traffic. When it comes to phishing attacks, Firefox improved its standing against IE8; the two browsers scored a statistical tie (IE8, 83 percent; Firefox 3, 80 percent). Opera 10 dramatically improved its performance from the malicious traffic test by catching 54 percent of phishing attacks. Chrome 2 and Safari 4 rounded out the test field, catching 26 percent and 2 percent of the attacks, respectively. “Web browsers are in a unique position to combat phishing and other criminal activities by warning potential victims that they are about to stray onto a malicious Website. Since phishing sites have an average lifespan of only 52 hours, it is essential that the site is discovered, validated, classified and added to the reputation system as quickly as possible… The developers at both Microsoft and Mozilla clearly understand this relationship and respond quickly to block new phishing sites,” NSS Labs wrote in its report. It’s easy to dump on Microsoft for its long history of security vulnerabilities and faulty software. And browser purists will argue the feature virtues and performance of Firefox, Safari and Chrome over Internet Explorer. But the NSS Labs test shows that the superior security performance of Internet Explorer 8 should give users pause in considering a switch to a competing browser. |
Comments (14)
Love it! This is what Microsoft promised when IE8 was released and it looks like they're following through.
Posted by Spencer Ferguson | August 21, 2009 2:18 PM
That was really a test of the browser vendors' respective threat publishing networks. Have there been any recent tests of the actual browsers' security -- i.e. what happens after you click a link to malicious content?
Posted by William | August 21, 2009 6:15 PM
Microsoft paid for the "test", according to Amy
Barzdukas, General Manager of Internet Explorer.
Maybe the fact that Microsoft was behind the test
in the reason they tested against an older version
of Safari, and that they threw out the results
showing that IE was so vulnerable to drive by
downloads. Other media have been reporting on how
bogus the "test" was for at least a week.
Posted by Ray | August 21, 2009 11:04 PM
And what about Firefox3.5.1 with NoScript, Adblock Plus and DrWeb anti-virus link checker? IE8 is still playing catchup.
Posted by kombipete | August 22, 2009 12:29 AM
IE8 running stock compared against Firefox with a bunch of third-party add-ons. Right. Totally un-biased there.
I wonder if there's any coincidence that the browsers that fell to IE8's "superiority" did so in order of their relative market share? >_
Posted by Deadweasel | August 22, 2009 3:51 PM
I dumped IE for Firefox a long time ago, now it looks like I might have to give IE another go. I wonder if there is a NoScript, or AdBlock like feature for IE?
@William,
Once you click a link, the browser should execute your desires. What happens next should be contained by the operating system, not the browser. I would like it if the browser was inside some sort of container, but it would raise the issue of what to do with updating software, where downloads go, and how to tell software you installed vs. self installing helper solfware (eg, Google Updater), vs. malware.
Posted by Gordon Stangler | August 23, 2009 9:58 AM
Yes, IE8 is so secure it blocks most of the online freight tracking software we use at my work - we had to roll-back to IE7 on all the affected machines to continue operating.
And it tries to install itself every time Windows Automatic Updates runs, so you have to teach users to choose not to allow the update every month.
And it trashes up the menus on my personal website.
Posted by GrumpyNoMore | August 23, 2009 7:23 PM
I'm checking into whether Microsoft underwrote the test. I reviewed the pretest parameters and the post-test reports, none of which indicated any outside sponsors.
There's always room for a healthy degree of skepticism when it comes to the security of Microsoft products. Even if we want to split hairs over which version should have been tested, the strong performance of IE8 does reflect the effort Microsoft has placed in improving the security of its software.
Posted by Larry Walsh | August 23, 2009 10:58 PM
This is old news. Microsoft did, in fact, underwrite these tests. It is no surprise of the results.
http://www.networkworld.com/news/2009/081309-microsoft-ie8-browser-security.html?fsrc=netflash-rss" rel="nofollow"
Posted by Mike | August 24, 2009 9:47 AM
GrumpyNoMore: compatibility view, hide update, and better code would likely fix everything in minutes.
As for the article, this is not a security test as much as it is a comparison of phishing feeds. I don't doubt the result of the study but it is meaningless.
IE protected mode is real security; other browsers still lack that type of function. Plugins are (and have been for some time) the gaping security hole in browsers. The number of active exploits in flash, java, and adobe reader alone are outrageous. The only plugin I keep enabled in firefox is flash which is limited by the flashblock extension. A bit of trust for the extension maintainer is still required however.
But I don't care about all that. IE is the most secure browser at the moment but it remains the lowest common denominator for support of relevant web technologies and standards. It is depressing that IE will never implement support for SNI (which could vastly consolidate IP address space) or HTML5 (even though microsoft's terrible implementation of HTML was the primary impetus for its creation).
IE is keeping the progress of the web down and the only way to eliminate it is by countering the campaign of misdirection with a campaign of raving hatred since the masses are only interested in the headlines. This is a battle of propagandized public opinion that cannot be fought with rational argument.
Posted by Jones | August 24, 2009 10:03 AM
hrm.. i dont think ie8 comes on linux.. linux, mac, no viruses.. so dont use windows.
Posted by linux lover | August 24, 2009 4:48 PM
The thing is, when a MAC catches a virus, you have no idea that you even have it! That's the effect of the brilliance of a MAC user who thinks his/her system is invulnerable.
Same goes for Linux distros.
Posted by Rob | August 25, 2009 4:20 AM
I've used (and use) them all (Windows, OSX, Linux [Ubuntu, CentOS, Redhat]). Mac and Linux are more secure from threats largely because they represent such a small fraction of the OS user-base and malware developers are ignoring them. If OSX or any distro of Linux held a significant % of the base end-users that Microsoft has, they would need malware scanners just like Windows users.
Posted by NB | August 28, 2009 2:12 PM
Wow, they used Chrome v2????! Chrome is on version 4. This is like comparing Internet Explorer 4 instead of Internet Explorer 8.
Did some quick research, NSS Labs was hired by... you guessed it: Microsoft's Online Security Engineering Team. Here's the link: (http://arstechnica.com/microsoft/news/2009/08/microsoft-sponsors-two-nss-reports-ie8-is-the-most-secure.ars)
Posted by Steve | November 18, 2009 11:13 AM